Windows Rapid Authentication On Multiple Hosts

This analytic detects a single source computer authenticating to 30 or more remote endpoints within a 5-minute timespan using Windows Event ID 4624 (successful logon). This behavior is identified by analyzing Windows Event Logs for LogonType 3 (network logon) events and counting unique target computers. Such activity is significant as it may indicate lateral movement or network share enumeration by an adversary. If confirmed malicious, this could lead to unauthorized access to multiple systems, potentially compromising sensitive data and escalating privileges within the network.